Sample redacted report
Below is a full facsimile of a real Dhara recon report, with target names and specific asset fingerprints redacted. Your report will look exactly like this, one per finding, mapped to the framework you request.
Target
Healthcare information exchange · ABDM HIE-CM integrator · India
Executive summary
Severity distribution
Findings (redacted)
Archived copies of the /patient/consent-history page cached at a third-party archive include unredacted consent-artefact identifiers. Identifiers are long-lived and re-usable for replay against ABDM gateway under specific misconfigurations.
Certificate Transparency logs show a wildcard leaf issued 2025-09-12 that still covers subdomains resolving to parked IPs. Past pre-production hosts re-resolved to attacker-controllable CNAMEs.
Anonymous GET on the metadata endpoint returns the server CapabilityStatement, including resource types the application does not intend to expose (e.g. AuditEvent, Consent) and OAuth endpoints pointing to a pre-production issuer.
HTTP 200 to /login with default-theme Grafana branding. Version banner (8.2.x) is affected by CVE-2021-43798. Even without login, path traversal in the affected version permitted arbitrary file reads in the container.
No _dmarc TXT record published. Permits spoofed sender addresses; downstream impact on phishing-based PHI exfiltration. SPF present but not aligned.
CNAME chain resolves to an object-storage provider. The bucket root returns XML ListBucketResult with 1,400+ keys. No evidence of PHI in filenames observed at report time, but access pattern is consistent with inadvertent public exposure.
generator meta tag reveals WordPress 5.9.x. Two plugins fingerprinted (redacted) have known authenticated RCEs in their current major versions.
Passive fingerprint of banner indicates an end-of-life Postfix build. Historical scanning datasets flag the same host as relay-permissive. Not re-validated by Dhara (passive profile).
Two code comments in an archived JS bundle reference internal ticket identifiers and a private JIRA hostname. Useful for social-engineering pretexts; no direct auth material exposed.
No disclosure-policy document. Responsible-disclosure researchers have no channel to reach the team. Not a vulnerability but a widely expected hygiene signal for healthcare operators.
Banner and CapabilityStatement imply HIE-CM protocol version 1.4. Flagged informationally so the rest of the report can be read against the right version of the specification.
Your report lands in your inbox within 24 hours of request. Passive only.